225 matches found
CVE-2026-20841
CVE-2026-20841 - Windows Notepad Remote Code Execution RCE Security Research & Technical Analysis Repository ⚠️ This repository is intended for educational, defensive, and research purposes only. 📖 Overview CVE-2026-20841 is a critical Remote Code Execution RCE vulnerability affecting Microsoft...
CVE-2026-116100
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The explo...
CVE-2026-116100 gougucms User Level Level.php add cross site scripting
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The explo...
EUVD-2026-109585
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The explo...
CVE-2026-116100 gougucms User Level Level.php add cross site scripting
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The explo...
CVE-2026-116100
A cross-site scripting (XSS) vulnerability exists in gougucms up to version 4.08.18 . The flaw is located in the Add function of the app/admin/controller/Level.php file within the User Level Handler component. By manipulating the Title argument, an attacker can execute a remote XSS attack. Public...
PT-2026-123127
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The explo...
CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...
EUVD-2026-97506
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...
CVE-2026-85948: Improper Privilege Management
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...
PT-2026-110641
Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9 Description An XQuery injection flaw exists in a deprecated Management API package path. A remote attacker with manage-user-level privileges can...
PT-2026-93959
Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue exists that allows an authenticated remote attacker with high-privileged administrative credentials to execute arbitrary commands on the underlying operating system. This is caused...
PT-2026-92303
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the code allows for a permission bypass in multiple locations. This issue can lead to local escalation of privilege, requiring only user executi...
CVE-2026-82431
The Apache Storm cluster is vulnerable to an authorization bypass in the SimpleACLAuthorizer component. The vulnerability occurs because the authorizer returns early when the nimbus.users list is empty, failing to evaluate the nimbus.groups list. Consequently, operators who configure access restr...
JetBrains TeamCity < 2019.2 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2019.2. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role. CVE-2020-7910 - In JetBrains TeamCity before 2019....
PT-2026-68229
Name of the Vulnerable Software and Affected Versions Cisco Terminal Service TS Agent affected versions not specified Description A flaw in the network driver allows an authenticated remote attacker to bypass firewall rules linked to their own account. This occurs because of an incorrect mapping ...
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped authToken. The repository does not provide a token-bearing auth line. It only...
CVE-2026-3568
CVE-2026-3568 affects the WordPress MStore API plugin up to version 4.18.3. The root cause is in update_user_profile() processing the raw JSON field 'meta_data' without validation, allowlisting, or sanitization, and then applying arbitrary keys/values to update_user_meta() after cookie-based auth...
